[java-idp-plugin-vci] 01/01: Do not check client id when unwrapping pre-auth grant

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/REM_PREAUTH_CLIENT_VER
in repository java-idp-plugin-vci.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-plugin-vci/commit/5143bba2794d1ba1e5475732804d350a344b428a

commit 5143bba2794d1ba1e5475732804d350a344b428a
Author: jlauros <janne.lauros at csc.fi>
AuthorDate: Tue Dec 9 11:20:14 2025 +0200

    Do not check client id when unwrapping pre-auth grant
---
 .../plugin/openidvci/profile/impl/UnwrapGrant.java        | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
index d331cba..dbb30e7 100644
--- a/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
+++ b/openid-vci-impl/src/main/java/org/geant/shibboleth/plugin/openidvci/profile/impl/UnwrapGrant.java
@@ -170,7 +170,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
                     }
                 }
             }
-            validateTokenClaimsSet(profileRequestContext, tokenClaimsSet);
+            validateTokenClaimsSet(profileRequestContext, tokenClaimsSet, true);
             final OIDCAuthenticationResponseContext oidcResponseContext = getOidcResponseContext();
             assert oidcResponseContext != null;
             oidcResponseContext.setAuthorizationGrantClaimsSet(tokenClaimsSet);
@@ -193,7 +193,7 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
                     return;
                 }
                 log.debug("{} pre-authorized grant unwrapped {}", getLogPrefix(), credentialOffer.serialize());
-                validateTokenClaimsSet(profileRequestContext, credentialOffer);
+                validateTokenClaimsSet(profileRequestContext, credentialOffer, false);
                 TokenContext tokenContext = profileRequestContext.getInboundMessageContext()
                         .ensureSubcontext(TokenContext.class);
                 tokenContext.setCredentialOfferObject(CredentialOfferObject.parse(credentialOffer.getSubject()));
@@ -232,22 +232,25 @@ public class UnwrapGrant extends AbstractOpenIDVCITokenResponseAction {
     }
 
     private void validateTokenClaimsSet(@Nonnull final ProfileRequestContext profileRequestContext,
-            TokenClaimsSet tokenClaimsSet) {
+            TokenClaimsSet tokenClaimsSet, boolean clientMatch) {
         if (tokenClaimsSet == null) {
             log.warn("{} Grant type not supported", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
             return;
         }
         if (!tokenClaimsSet.isTimeValid()) {
-            log.warn("{} Token is expired or not net valid", getLogPrefix());
+            log.warn("{} Token is expired or not yet valid", getLogPrefix());
             ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
             return;
         }
+        if (!clientMatch) {
+            // pre-authorized grants are for any.
+            return;
+        }
         final ClientID clientId = tokenClaimsSet.getClientID();
         assert clientId != null;
         final ClientID requestClientId = clientIDLookupStrategy.apply(profileRequestContext);
-        final ClientID inheritedClientId = new ClientID(clientId.getValue() + "/wallet");
-        if (!clientId.equals(requestClientId) && !inheritedClientId.equals(requestClientId)) {
+        if (!clientId.equals(requestClientId)) {
             log.warn("{} Token issued to client {}, invalid for {}", getLogPrefix(), clientId.getValue(),
                     requestClientId);
             ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.